15702 matches found
EXNESS: Unrestricted Access to Celery Flower Instance
The publicly accessible Celery Flower instance allowed unrestricted access, exposing sensitive information, and the ability to manipulate tasks...
Reddit: [accounts.reddit.com] Redirect parameter allows for XSS
The dest parameter in accounts.reddit.com was vulnerable to Cross-Site Scripting XSS attacks, allowing an attacker to execute malicious code and steal user cookies by tricking them into logging in. The vulnerability was exploitable both for logged-in and logged-out users...
Internet Bug Bounty: CVE-2023-27535: FTP too eager connection reuse
A vulnerability was found in libcurl versions 7.13.0 to 7.88.1 that allowed the reuse of previously created FTP connections even when one or more options had been changed, leading to the second transfer being done with wrong credentials. This was due to several FTP settings being left out from th...
Internet Bug Bounty: Rails::Html::SafeListSanitizer vulnerable to xss attack in an environment that allows the style tag
It seems to be a problem caused by a difference between the nokogiri java implementation and the ruby implementation. jruby9.3.3.0 nokogiri java, use Rails::Html::SafeListSanitizer.new.sanitize, allow select/style tag code tags = %wselect style puts...
Cloudflare Public Bug Bounty: HTTP request smuggling with Origin Rules using newlines in the host_header action parameter
The hostheader action parameter available to rulesets in the Origin Rules API lacked sufficient input validation i.e., allowing CRLF characters. Because of this, it was possible to inject arbitrary headers and, as a consequence, smuggle HTTP requests. This vulnerability enabled bypassing security...
curl: CVE-2022-27781: CERTINFO never-ending busy-loop
Summary: Curl is prone to a DoS attack in case the NSS TLS library is used and the CERTINFO option is enabled. Using maliciously crafted certificates on a server, an attacker can make curl run into an endless loop when connecting to the server. The bug is located in the following code segment...
Shopify: Ability to publish a paid theme without purchasing it.
Hi, Description I kept looking for alternatives to my report 927567 and I found another way to publish a paid theme without having to purchase it. This time the trick is to send "ThemePublishLegacy" XHR request while the theme is being installed. Requirements 1. Google Chrome suggested because...
Stripo Inc: Cross-Site WebSocket Hijacking Lead to Steal XSRF-TOKEN
The WebSocket handshake request was vulnerable to CSRF, WebSocket content was contain many sensitive data for the user It was like the PortSwigger Lab...
h1-ctf: [H1-2006 2020] Exploiting multiple vulnerabilities to get hacker's payment ensured
Last week, Hackerone’s CEO Marten lost his credentials for BountyPay. A tweet from hackerone’s official twitter account asked for help from ethical hackers and bounty hunters to help the CEO recover his credentials and insure May’s payments. As an active bug hunter on Hackerone, I decided to take...
h1-ctf: [H1-2006 2020] CTF Writeup
Just submitting Flag for now, Will soon submit Writeup : Impact Flag: ^FLAG^736c635d8842751b8aafa556154eb9f3$FLAG$...
Mail.ru: [my.games] Stored XSS via untrusted bucket
Domain, site, application -- https://my.games/ Details -- If you check page source of https://my.games, you can notice that site gets static files scripts, styles, images using following URL declaration: https://my.games/hotbox/mygames/frontend/v3-6-13/img/share/main.png mygames here is a name of...
Bumble: Bruteforce password recovery code
Summary It's possible to bruteforce recovery code from SMS as iOS application doesn't have limits for incorrect inputs. I have tried 50+ different combinations until I reached code from SMS. Steps To Reproduce 1. Click "Use another option" on application startup view 1. Enter your phone number 1...
Genasys Technologies: Login Bypass to OTP Enumeration
Summary: If an attacker gets access to the victim's username or know the email used for logging in to the application.He can bypass the login by enumeration og One Time Password. Steps To Reproduce: 1.Go to https://staging.genasystech.co.uk/d2c/ 2.Create an account ,Enter the relevant pin for...
Rockstar Games: [IMP] - Blind XSS in the admin panel for reviewing comments
@anshumanbh discovered that it is possible to exploit a Blind XSS vulnerability under the "MOUTHOFF TO ROCKSTAR" section while providing feedback. The result is a XSS vulnerability being exploited on an internal Rockstar Games domain. The way this worked was that an attacker would submit a...
Deriv.com: login to any user's cashier account and full account information disclosure
Hi , I have found an issue allowing an attacker to login to any user's cashier account and view sensitive user information by just knowing the user account ID. Steps to reproduce: 1. open 2 browsers and create 2 accounts , login with each account on a browser. 2. let's call account 1 , the victim...
Monero: A peer can remotely fill the pending block queue to an extremely high size, with blocks that will never leave the queue.
The pending block queue in the Monero cryptocurrency protocol could be remotely filled to an extremely high size, up to approximately 54 GB, with blocks that would never leave the queue. This was possible due to lax rules in the synchronization code that allowed the queue size limit to be bypasse...
curl: CVE-2024-2398: HTTP/2 push headers memory-leak
CVE-2024-2398 was a memory-leak vulnerability in the HTTP/2 push headers implementation of libcurl. For each incoming PUSHPROMISE header, a new string was allocated and stored in an array. When the number of headers exceeded a threshold, libcurl freed the array but forgot to free the individual...
U.S. Dept Of Defense: Wordpress Takeover using setup configuration at http://████.edu [HtUS]
A vulnerability was found in the WordPress 'setup-config.php' installation page, which allowed a malicious user to install WordPress in a remote MySQL database without valid credentials on the target system. This could lead to remote code execution and total system compromise, as well as other...
Palo Alto Software: DNS Miconfiguration Leads to Subdomain Takeover - max1.liveplan.com
Summary The issue happens due to using EC2 public DNS instead of using Elastic IPs as CNAME record. This report is simliar to report 1069795 Misconfiguration - DNS Records json "host": "max1.liveplan.com", "resolver": "1.0.0.1:53" , "a": "54.68.121.128" , "cname":...
Logitech: Sensitive information disclosure to shared access user via streamlabs platform api
Summary: Hi there, Hope you are doing well and stay safe. Streamlab allows us to invite other users to manage our dashboard and cloudbot functions via following setting which named "Shared Access". https://streamlabs.com/dashboard/settings/shared-access If we invite other users with Moderator rol...
HackerOne: Graphql: Sorting the reports by jira_status field resulted to different value
Summary: Sorting the reports by jirastatus yield to different result depicting the team is using jira even the user has no access. Description: A user with no access to jira information of any reports can somehow access the jira field using orderby through jirastatus Using the 2 graphql below we...
Equifax-vdp: Open SonarQube instance leaking internal source code
Summary I came across an open SonarQube instance which can be found here: http://34.238.92.229:9000/ In this, there are 10 projects with a total of around 100k lines of code To identify the owner, I went to the Issues tab and expanded the list of authors. There were 29 people there, and many of...
Ruby on Rails: Untrusted users able to run pending migrations in production
Untrusted users able to run pending migrations in production There is a vulnerability in versions of Rails prior to 6.0.3.2 that allowed an untrusted user to run any pending migrations on a Rails app running in production. This vulnerability has been assigned the CVE identifier CVE-2020-XXXX...
GitHub Security Lab: Initial websocket support for Javascript (SockJS)
This bug was reported directly to GitHub Security Lab...
Mail.ru: XSS at go.mail.ru
DOM-based self XSS in go.mail.ru social search functionality...
New Relic: Bypassing Protection Mechanism: Change of Account Name after Session Log out
The researcher illustrated a delay in session invalidation. This has not been added to our public policy to help prevent confusion...
Bumble: Reflected XSS
The researcher has found an XSS when sending messages through our service...
Rocket.Chat: Clickjacking in the admin page
Summary: Hello Rocket.Chat, There is a clickjacking vulnerability in a very critical page which is the admin info page. For my installation, the URL https://penetrationtester.rocket.chat/admin/users was used for creating the PoC. Description: Clickjacking User Interface redress attack, UI redress...
Internet Bug Bounty: Heap Buffer Overflow (READ: 1786) in exif_iif_add_value
The exifreaddata function is prone to an out of bounds read while processing crafted JPG data. This was discovered using AFL. It can be reproduced as follows: USEZENDALLOC=0 php -r...
Pornhub: Stored XSS (client-side, using cookie poisoning) on the pornhubpremium.com
The researcher discovered that a parameter's value was stored in a cookie and that cookie's value was echoed in certain pages. The researcher was successful in providing an XSS payload as this parameter's value and having it execute. DOM XSS through cookie. Discovered by manual inspection of JS...
Yelp: Yelp.com is vulnerable to SWEET32 attack
Researchers have found new attack against 3DES-CBC cipher in TLS,that they can decrypt customer data using a method called SWEET32 Birthday Attack. This Vulnerability has got CVE-2016-2183 and has cvss score 5.0 This vulnerability can be found manually by simply using nmap script nmap -Pn -p...
drchrono: Stored XSS via AngularJS Injection
Hi All, I've found a stored XSS vulnerability via an Angular Template Injection in the messages referral address field. Description After visiting https://1337test.drchrono.com/messages/referrals/contacts/, you can enter new contact information. In the field for the address, if enter 55, when the...
StopTheHacker: Wordpress flashmediaelement.swf XSS on stopthehacker.com
Hi, It appears that the domain stopthehacker.com has an XSS vulnerability, specifically in flashmediaelement.swf. PoC: https://www.stopthehacker.com/wp-includes/js/mediaelement/flashmediaelement.swf?jsinitfunctio%gn=alertPoC%20PoC%20PoC Please see the attached screen shot for the alert box...
Uber: Reflected XSS on developer.uber.com via Angular template injection
developer.uber.com is vulnerable to reflected XSS via Angular template injection. The following url demonstrates the root issue using a trivial payload: https://developer.uber.com/docs/deep-linking?q=wrtz77 If you view the rendered source of the resulting page, you'll find the string 'wrtz49',...
Phabricator: SSRF vulnerability (access to metadata server on EC2 and OpenStack)
In bug 50537, haquaman reported a SSRF vulnerability in the meme creation section of Phabricator. Ticket T6755 was created and the HackerOne issue was closed as "Won't fix". T6755 states that "attackers can use the machine's ability to access the network, which may allow them to find services and...
Sandbox Escape: .NET Type Traversal Vulnerability
This issue was reported directly to Microsoft and has been resolved in MS14-009. https://technet.microsoft.com/library/security/ms14-009ID0E3PCI...
Rocket.Chat: Unauthenticated file deletion via deleteFileMessage DDP method allows permanent destruction of any uploaded file
Vulnerability description not provided...
FetLife: fetlife.com/signup_step_profile expose access_token of mapbox.com
Vulnerability description not provided...
Node.js: HTTP Request Smuggling via Empty headers separated by CR
HTTP Request Smuggling HRS was possible in Node.js v20.2.0 due to the llhttp parser in the http module not strictly using the CRLF sequence to delimit HTTP requests. The CR character without LF was sufficient to delimit HTTP header fields in the llhttp parser, which is not compliant with RFC7230...
Internet Bug Bounty: CVE-2023-28320 - siglongjmp race condition
A race condition vulnerability CVE-2023-28320 existed in libcurl's synchronous resolver, which could allow a multi-threaded application to crash or misbehave due to the use of a global buffer that was not mutex protected. The vulnerability could result in a denial of service...
U.S. Dept Of Defense: Default Credentials on Kinetic Core System Console - https://█████/kinetic/app/
Weak default credentials of "admin/admin" were discovered on the Kinetic Core System Console application, potentially allowing attackers to identify underlying technologies and access sensitive information such as server logs and user data. The vulnerability was present in version 2.1.0-SNAPSHOT...
curl: CVE-2022-32206: HTTP compression denial of service
Summary: Curl does not prevent resource consumption when processing certain header types, but keeps on allocating more and more resources until the application terminates or the system crashes, see below. The attack vectors include at least: - Sending many Transfer-Encodingwith repeated encodings...
GitHub Security Lab: Java : Add query for detecting Log Injection vulenrabilities
This bug was reported directly to GitHub Security Lab...
WHO COVID-19 Mobile App: Internal API endpoint is accesible for everyone
Summary: It looks like the endpoint /internal/cron/refreshCaseStats as configured in cron.yaml https://github.com/WorldHealthOrganization/app/blob/master/server/appengine/src/main/webapp/WEB-INF/cron.yamlL3 is accesible for everyone. Since it is configured as a cronjob to run every 5 minutes and...
Automattic: Sql injection on docs.atavist.com
hello dear team I have found SQL injection on docs.atavist.com url:http://docs.atavist.com/readerapi/stories.php?limit=10&offset=20&organizationid=88822&search=0&sort= parameters: injectable search=0 Parameter: search GET Type: AND/OR time-based blind Title: MySQL = 5.0.12 AND time-based blind...
TikTok: HTML Injection on Company Name on Email
By changing the company name to any HTML code on the TikTok Creator Marketplace, an attacker could potentially use this to send phishing emails to users containing injected HTML payload. We thank @gnux for reporting this to our team and confirming the resolution!...
Figma: Race condition while removing the love react in community files.
The researcher found that the server-side code for handling the "unlike" function for community pages was vulnerable to a race condition. While logically one person is only allowed to remove the one like they had, a hundred requests at the same time could allow one person to do a hundred unlikes...
Dropcontact: Unrestricted File Upload on https://app.dropcontact.io/app/upload/
hi team, I found Unrestricted File Upload Vulnerabilities on https://app.dropcontact.io/app/upload/. Steps To Reproduce: 1. Create an account in https://app.dropcontact.io/app/ 1. go to https://app.dropcontact.io/app/upload/ 1. try to upload html file , you will see message only : .csv, .txt, .xl...
Shopify: Email Confirmation Bypass in your-store.myshopify.com which leads to privilege escalation
Hello Shopify, I have found a bug by which I can verify any email on .myshopify.com, the bug is very strange but it works. Also I can take over the accounts but only the ones which do not have SSO. To reproduce please follow the steps exactly as I written otherwise you will not be able to reprodu...